Card Status Lifecycle — Core Card Program

Overview

This document describes the complete card status lifecycle for the Core Card Program, including supported statuses, creation behavior, and valid status transitions along with the APIs that trigger them.

---

Supported Statuses

Status	Description	Reversible?
ACTIVE	Card is active and can be used for transactions.	—
INACTIVE	Card is deactivated. Can only be reactivated via the Activate Card API.	✅ Yes — via Activate Card API only
LOCKED	Card is temporarily locked (e.g. by cardholder request).	✅ Yes — via Update Card Status API
LOST	Card has been reported lost.	❌ No — terminal
STOLEN	Card has been reported stolen.	❌ No — terminal
BLOCKED	Card has been blocked.	❌ No — terminal

---

Card Creation

Card Type	Initial Status	Behavior
Virtual	ACTIVE	Auto-activated on creation
Physical	ACTIVE	Auto-activated on creation

Both virtual and physical cards under the Core program are created directly in ACTIVE status. There is no INACTIVE starting state at creation.

---

Status Transition Rules

1. ACTIVE → INACTIVE, LOCKED, LOST, STOLEN, BLOCKED All performed via the Update Card Status API.

2. LOCKED → ACTIVE Reactivation from LOCKED is allowed directly via the Update Card Status API — no separate activation call needed. This is the only valid transition from LOCKED.

3. INACTIVE → ACTIVE Reactivation from INACTIVE requires the Activate Card API. It cannot be done via the Update Card Status API. This is the only valid transition from INACTIVE.

4. Terminal statuses: LOST, STOLEN, BLOCKED These are reachable only from ACTIVE. Once a card reaches any of these statuses, no further transitions are allowed — the card is permanently blocked.

Note: LOCKED and INACTIVE cannot transition to each other, and neither can move directly to LOST, STOLEN, or BLOCKED. A card must return to ACTIVE first before any of those transitions are possible.

---

Full Transition Table

From	To	Method
(creation)	ACTIVE	Auto-activated (virtual & physical)
ACTIVE	INACTIVE	Update Card Status API
ACTIVE	LOCKED / LOST / STOLEN / BLOCKED	Update Card Status API
LOCKED	ACTIVE	Update Card Status API
INACTIVE	ACTIVE	Activate Card API only
LOST / STOLEN / BLOCKED	—	No further transitions (terminal)

---

Lifecycle Flowchart

                     ┌───────────────────────────┐
                     │       Card Created        │
                     │    (Virtual & Physical)   │
                     └─────────────┬─────────────┘
                                   │ auto-activated
                                   ▼
                             ┌────────────┐
              ┌─────────────►│   ACTIVE   │◄─────────────┐
              │              └──┬───┬───┬─┘              │
              │                 │   │   │                │
   Update Card Status API       │   │   │        Activate Card API
   ("LOCKED" → "ACTIVE")        │   │   │      ("INACTIVE" → "ACTIVE")
              │                 │   │   │                │
      ┌────────────┐            │   │   │     ┌────────────┐
      │   LOCKED   │◄───────────┘   │   └────►│  INACTIVE  │
      └────────────┘    Update      │   ▲     └────────────┘
      (only "ACTIVE"    Card Status │   │      
  reachable from here)  API         │   │       
                        ("LOCKED")  │   Update Card Status API
                                    │   ("INACTIVE")
                                    │
                                    ▼
                 ┌────────────────────────────────────┐
                 │     Permanently Blocked States     │
                 │      (LOST, STOLEN, BLOCKED)       │
                 │   — reachable only from ACTIVE —   │
                 │   — Terminal (no reactivation) —   │
                 └────────────────────────────────────┘

---

Implementation / Validation Notes

1. Auto-activate both virtual and physical cards at creation — do not route through INACTIVE.
2. Allow LOCKED → ACTIVE directly via the Update Card Status API.
3. Block INACTIVE → ACTIVE on the Update Card Status API; require the Activate Card API for this specific transition.
4. Once a card is LOST, STOLEN, or BLOCKED, reject all further status update requests.
5. Log the actor/reason for every transition into a terminal status for audit and compliance purposes.